It looks like
@tailscale will be implementing funnel + authentication.
https://bsky.app/profile/apenwarr.ca/post/3lru7au6etk25
I'm thrilled about this. It will be fantastic for Dropserver and any other #selfhosted thing where you want to give access to friends without inviting the entire universe to poke at your server.
Basically Tailscale will make all visitors authenticate via an identity provider before forwarding requests to your little server. Your app just has to authorize based on whether you recognize that email or not.